Re: Linux audit performance impact

On 15/02/18, Paul Moore wrote: > I would imagine a scenario where we introduced the new format in stages: > > #1 - Move in-kernel audit record string generation completely into > kernel/audit*.c. Benefits everyone regardless of the audit format. Ok. > #2 - Introduce a versioned audit API. The most difficult step for > obvious reasons. That infrastructure should already be in place. We just converted over the version field to a bitfield listing the availability of features. An initial call can be made to find out if it is supported, then use the feature switching bitfield to enable it. We could alternately make a different unicast socket available signalling its availability.

> #3 - Deprecate the old/existing audit record format, make it a Kconfig > option that defaults to off and emit a warning when the old formatting > is used. This will be a year, and most likely more, after step #2. > > #4 - Remove the old/existing audit record code. Once again, this > would happen a couple of years after step #3. I suspect in practice stesp #3 and #4 could take a lot longer.